Hello,
We are looking to roll out JSM for basic alert and incident management but I'm struggling with how Alerts and Incidents interact and starting to wonder if I'm missing a best practice rather than some features of JSM itself.
First a little background. Our primary mechanism for outage notification in our production cloud environment is UptimeRobot. Fundamentally, if a component of our production environment goes down, UptimeRobot will notice because it fails to respond to its periodic ping. UptimeRobot will then create an alert in JSM that notifies Cloud Operations staff of the outage. The really nice thing here is that when the component comes back online, another event is sent to JSM which automatically closes the associated downtime alert. Cloud Ops doesn't have to do anything but restart the offline service and UptimeRobot/JSM takes care of the rest.
However, what we really want is for that component downtime to also be considered to be an incident. Incidents in JSM have SLAs, they have custom fields, they have reporting, in short they have all kinds of Jira goodness that Alerts do not. Additionally, not all alerts are incidents and not all incidents will come from alerts.
Now for the problem, its relatively easy to use Jira automation to auto-create an incident any time there is a downtime alert from UptimeRobot. However there does not appear to be any way to automatically resolve an incident when its associated alert is closed. You don't want the alert to automatically close (because the component came back online) but then have the associated incident stay open. It would also be a shame to force the Cloud Operations staff to remember to go into Jira and close the incident.
I kind of get it in that technically a single incident could be linked to multiple alerts and that complicates things in the generic use case but...in our case that will never be true at least for UptimeRobot sourced alerts.
So, am I missing something here either in terms of a capability in Jira that I'm not aware of or maybe I'm not following some best practice?
